github
diff --git a/‎lib/start-proxy.js
Lines changed: 3 additions & 0 deletions b/‎lib/start-proxy.js
Lines changed: 3 additions & 0 deletions
diff --git a/‎lib/start-proxy.js.map
Lines changed: 1 addition & 1 deletion b/‎lib/start-proxy.js.map
Lines changed: 1 addition & 1 deletion
diff --git a/‎lib/start-proxy.test.js
Lines changed: 9 additions & 0 deletions b/‎lib/start-proxy.test.js
Lines changed: 9 additions & 0 deletions
diff --git a/‎lib/start-proxy.test.js.map
Lines changed: 1 addition & 1 deletion b/‎lib/start-proxy.test.js.map
Lines changed: 1 addition & 1 deletion
diff --git a/‎src/start-proxy.test.ts
Lines changed: 22 additions & 0 deletions b/‎src/start-proxy.test.ts
Lines changed: 22 additions & 0 deletions
diff --git a/‎src/start-proxy.ts
Lines changed: 4 additions & 0 deletions b/‎src/start-proxy.ts
Lines changed: 4 additions & 0 deletions
@@ -6,6 +6,9 @@ import { setupTests } from "./testing-utils";
 
 setupTests(test);
 
+const toEncodedJSON = (data: any) =>
+  Buffer.from(JSON.stringify(data)).toString("base64");
+
 test("getCredentials prefers registriesCredentials over registrySecrets", async (t) => {
   const registryCredentials = Buffer.from(
     JSON.stringify([
@@ -46,6 +49,25 @@ test("getCredentials throws an error when configurations are not an array", asyn
   );
 });
 
+test("getCredentials throws error when credential is not an object", async (t) => {
+  const testCredentials = [["foo"], [null]].map(toEncodedJSON);
+
+  for (const testCredential of testCredentials) {
+    t.throws(
+      () =>
+        startProxyExports.getCredentials(
+          getRunnerLogger(true),
+          undefined,
+          testCredential,
+          undefined,
+        ),
+      {
+        message: "Invalid credentials - must be an object",
+      },
+    );
+  }
+});
+
 test("getCredentials throws error when credential missing host and url", async (t) => {
   const registryCredentials = Buffer.from(
     JSON.stringify([{ type: "npm_registry", token: "abc" }]),
 
@@ -72,6 +72,10 @@ export function getCredentials(
 
   const out: Credential[] = [];
   for (const e of parsed) {
+    if (e === null || typeof e !== "object") {
+      throw new ConfigurationError("Invalid credentials - must be an object");
+    }
+
     // Mask credentials to reduce chance of accidental leakage in logs.
     if (e.password !== undefined) {
       core.setSecret(e.password);